{
  "document": {
    "aggregate_severity": {
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "* SECURITY UPDATE: Use-after-free because handler call depth tracking\n     was absent entirely, leaving XML_Parse, XML_ParseBuffer,\n     XML_GetBuffer, XML_ParserFree, XML_ParserReset and XML_ResumeParser\n     callable on the running parser from inside an application handler,\n     and the XML_TOK_DATA_CHARS handler calls in doCdataSection() left\n     untracked (libexpat before 2.8.2)\n     - debian/patches/CVE-2026-56131.patch: introduce the handler call\n       depth counter m_handlerCallDepth with the beforeHandler() /\n       afterHandler() / isCalledFromInsideHandler() helpers from upstream\n       PR #1246, wrap all 55 handler call sites in expat/lib/xmlparse.c,\n       and reject the six affected entry points with XML_STATUS_ERROR /\n       NULL when the counter is non-zero; XML_StopParser and\n       XML_ExternalEntityParserCreate are deliberately left unguarded, as\n       upstream intends.  Also carries upstream PR #1278, which wraps the\n       two doCdataSection XML_TOK_DATA_CHARS charDataHandler calls that\n       the original framework missed and through which the depth guard\n       was otherwise bypassable.  Of the 55 wrapped call sites 53 are\n       live; the other two sit inside expat's pre-existing\n       \"else if (0 && ...)\" disabled branches, which upstream 2.8.2 wraps\n       as well.  Carries upstream's regression test into\n       expat/tests/runtests.c.  Behaviour change inherited from upstream:\n       leaving a handler through a non-local exit, such as a C++\n       exception or longjmp(), skips afterHandler(), so the counter stays\n       non-zero and every guarded entry point refuses from then on,\n       XML_ParserFree() included.  Upstream accepts the resulting leak in\n       place of a use-after-free and provides no way to clear the counter\n     - CVE-2026-56131\n     - CVE-2026-50219\n     - CVE-2026-56412\n   * SECURITY UPDATE: Quadratic runtime when detecting duplicate default\n     attributes, allowing denial of service through a crafted DTD\n     (libexpat before 2.8.1)\n     - debian/patches/CVE-2026-45186.patch: add\n       ELEMENT_TYPE.defaultAttsNames and resolve default-attribute\n       collisions through a hash table lookup instead of a linear scan\n       over defaultAtts in defineAttribute(), with matching\n       hashTableInit()/hashTableDestroy() calls in storeAtts(),\n       getElementType(), dtdCopy(), dtdReset() and dtdDestroy() in\n       expat/lib/xmlparse.c.  The trade-off, upstream's as well, is one\n       hash table per element type: a constant extra amount of memory and\n       setup work per element type and per tag, linear in document size,\n       in exchange for removing the quadratic term\n     - CVE-2026-45186\n   * SECURITY UPDATE: Integer overflow when reallocating the tag name\n     conversion buffer (libexpat before 2.7.4)\n     - debian/patches/CVE-2026-25210.patch: reject a doubling that would\n       overflow before it happens (SIZE_MAX / 2 pre-check) and widen\n       doContent()'s bufSize from int to size_t in expat/lib/xmlparse.c.\n       Also carries the storeRawNames() half of upstream commit\n       25ec4f1b, which widens that function's bufSize and nameLen to\n       size_t.  Upstream released 25ec4f1b in 2.7.2, ahead of this fix in\n       2.7.4, and it is a prerequisite rather than cosmetics: once\n       tag->buf is allowed past INT_MAX bytes, the (int) narrowing of\n       convLen in doContent() can store a negative tag->name.strLen, and\n       storeRawNames() would then compute a negative int bufSize, skip\n       its reallocation and memcpy() below the buffer.  Widened, the same\n       value becomes a huge size_t, the reallocation fails and the\n       function returns XML_FALSE, which is how upstream 2.7.4 behaves\n     - CVE-2026-25210\n   * SECURITY UPDATE: Integer overflow in doProlog related to\n     storeEntityValue and entity textLen (libexpat before 2.8.2)\n     - debian/patches/CVE-2026-56407.patch: cap the entity value pool\n       length against INT_MAX before assigning m_declEntity->textLen in\n       expat/lib/xmlparse.c.  The second hunk of upstream commit\n       30c2fc17 is omitted because it targets storeSelfEntityValue(),\n       which arrived in expat 2.6.0 and does not exist here\n     - CVE-2026-56407\n   * SECURITY UPDATE: Integer overflow in copyString (libexpat before\n     2.8.2)\n     - debian/patches/CVE-2026-56408.patch: reject\n       charsRequired > SIZE_MAX / sizeof(XML_Char) before the allocation\n       in copyString() in expat/lib/xmlparse.c.  This is upstream parity\n       hardening rather than a live fix on 2.2.10: charsRequired is a\n       size_t holding the length of the application-supplied encoding\n       name rather than of document content, so tripping the guard would\n       need a string larger than the address space even in the\n       -DXML_UNICODE (buildw) library that debian/rules also builds,\n       where sizeof(XML_Char) is 2\n     - CVE-2026-56408",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222",
        "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/advisories/2026/clsa-2026_1788968222.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-09T15:38:09Z",
      "generator": {
        "date": "2026-09-09T15:38:09Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1788968222",
      "initial_release_date": "2026-09-09T15:38:09Z",
      "revision_history": [
        {
          "date": "2026-09-09T15:38:09Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "Fix of 5 CVEs"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 11",
                "product": {
                  "name": "Debian 11",
                  "product_id": "Debian-11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                "product": {
                  "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                  "product_id": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libexpat1-dev@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=arm64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                "product": {
                  "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                  "product_id": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/expat@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=arm64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                "product": {
                  "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                  "product_id": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libexpat1@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=arm64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                "product": {
                  "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                  "product_id": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libexpat1-dev@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=armel"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                "product": {
                  "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                  "product_id": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/expat@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=armel"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                "product": {
                  "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                  "product_id": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libexpat1@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=armel"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "armel"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                "product": {
                  "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                  "product_id": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libexpat1-dev@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                "product": {
                  "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                  "product_id": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/expat@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                "product": {
                  "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                  "product_id": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libexpat1@2.2.10-2%2Bdeb11u7%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64"
        },
        "product_reference": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
        },
        "product_reference": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64"
        },
        "product_reference": "libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64"
        },
        "product_reference": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
        },
        "product_reference": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64"
        },
        "product_reference": "expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
        },
        "product_reference": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64"
        },
        "product_reference": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64"
        },
        "product_reference": "libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56131",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-56131"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1267",
          "url": "https://github.com/libexpat/libexpat/pull/1267"
        }
      ],
      "release_date": "2026-06-19T06:17:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T15:37:04.332283Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222",
          "product_ids": [
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ]
    },
    {
      "cve": "CVE-2026-45186",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "notes": [
        {
          "category": "description",
          "text": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-45186"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1216",
          "url": "https://github.com/libexpat/libexpat/pull/1216"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/05/11/16",
          "url": "http://www.openwall.com/lists/oss-security/2026/05/11/16"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:22715",
          "url": "https://access.redhat.com/errata/RHSA-2026:22715"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:22721",
          "url": "https://access.redhat.com/errata/RHSA-2026:22721"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:23230",
          "url": "https://access.redhat.com/errata/RHSA-2026:23230"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:26319",
          "url": "https://access.redhat.com/errata/RHSA-2026:26319"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:27201",
          "url": "https://access.redhat.com/errata/RHSA-2026:27201"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:29197",
          "url": "https://access.redhat.com/errata/RHSA-2026:29197"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:58981",
          "url": "https://access.redhat.com/errata/RHSA-2026:58981"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2026-45186",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45186"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575"
        },
        {
          "category": "external",
          "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
        },
        {
          "category": "external",
          "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json",
          "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json"
        }
      ],
      "release_date": "2026-05-10T07:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T15:37:04.332283Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222",
          "product_ids": [
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-56408",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "libexpat before 2.8.2 has an integer overflow in copyString.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-56408"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817",
          "url": "https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817"
        }
      ],
      "release_date": "2026-06-21T16:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T15:37:04.332283Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222",
          "product_ids": [
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ]
    },
    {
      "cve": "CVE-2026-25210",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-25210"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1075",
          "url": "https://github.com/libexpat/libexpat/pull/1075"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7",
          "url": "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7"
        },
        {
          "category": "external",
          "summary": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html",
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
        }
      ],
      "release_date": "2026-01-30T07:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T15:37:04.332283Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222",
          "product_ids": [
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-56407",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
          "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-56407"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1262",
          "url": "https://github.com/libexpat/libexpat/pull/1262"
        }
      ],
      "release_date": "2026-06-21T16:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T15:37:04.332283Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222",
          "product_ids": [
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:expat-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-0:2.2.10-2+deb11u7+tuxcare.els1.armel",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.amd64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.arm64",
            "Debian-11:libexpat1-dev-0:2.2.10-2+deb11u7+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1788968222"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ]
    }
  ]
}